fix: pass provider capability as API key

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.15",
+      "version": "0.0.16",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "private": true,
   "type": "module",
   "engines": {

hub/src/connections/providerProxy.ts

@@ -80,8 +80,8 @@ export async function openProviderProxyLease(
   return {
     sdkEnv: {
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
-      ANTHROPIC_AUTH_TOKEN: capability,
-      ANTHROPIC_API_KEY: "",
+      ANTHROPIC_AUTH_TOKEN: "",
+      ANTHROPIC_API_KEY: capability,
     },
     sensitiveValues: [capability],
     async close(): Promise<void> {

hub/test/unit/provider-proxy.test.ts

@@ -52,14 +52,14 @@ describe("run-scoped provider proxy", () => {
     expect(serializedAgentEnv).not.toContain(String(address.port));
     expect(lease.sdkEnv).toMatchObject({
       ANTHROPIC_BASE_URL: expect.stringMatching(/^http:\/\/127\.0\.0\.1:\d+$/),
-      ANTHROPIC_AUTH_TOKEN: expect.any(String),
-      ANTHROPIC_API_KEY: "",
+      ANTHROPIC_AUTH_TOKEN: "",
+      ANTHROPIC_API_KEY: expect.any(String),
     });
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
       method: "POST",
       headers: {
-        authorization: `Bearer ${lease.sdkEnv.ANTHROPIC_AUTH_TOKEN}`,
+        "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "",
         "content-type": "application/json",
         "anthropic-version": "2023-06-01",
       },
@@ -127,7 +127,7 @@ describe("run-scoped provider proxy", () => {
     leases.push(lease);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
-      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_AUTH_TOKEN ?? "" },
+      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "" },
     });
 
     expect(response.status).toBe(200);
@@ -167,7 +167,7 @@ describe("run-scoped provider proxy", () => {
     leases.push(lease);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
-      headers: { authorization: `Bearer ${lease.sdkEnv.ANTHROPIC_AUTH_TOKEN}` },
+      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "" },
       redirect: "manual",
     });